DOCSLIB.ORG

Ddos Beasts and How to Fight Them

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Ddos Beasts and How to Fight Them DDoS Beasts and How to Fight Them Artyom Gavrichenkov <[email protected]> Timeline of ancient history • First attacks: 1999-2000 • 2005: STRIDE model by Microsoft • Spoofing Identity • Tampering with Data • Repudiation • Information Disclosure • Denial of Service • Elevation of Privileges [D?]DoS The difference between “a distributed attack” and an, err, not distributed one is vague. Traditional meaning: a distributed attack comes from multiple sources. • What is a source? Is it an IP address or a machine? • If it is a machine, does a virtual instance count? Or a few instances under the same physical hypervisor? What if they often migrate between physical machines? If I’m a victim, how do I tell a single-sourced from a multiple-sourced? • If it is an IP, then how do we treat spoofed traffic? [D?]DoS Hence, a different sort of thinking applies: • DoS (as implied in STRIDE): a vulnerability in a software (e.g. NULL pointer dereference, like Ping of Death) • DDoS: computational resource exhaustion Risk management The basic idea behind STRIDE and other approaches is risk assessment, modelling and management. Probability/Impact Matrix Trivial Minor Moderate Significant Severe Rare Unlikely Moderate Likely Very Likely Probability/Impact Matrix Trivial Minor Moderate Significant Severe DDoS attack, Rare 2018 Unlikely • Impact: Moderate Likely Severe Very Likely • Probability: ? Motivation of an attacker • Fun! • Blackmail • Self-promotion • Political statement • Revenge • Market competition • Diverting attention (e.g. in case of theft) • Preventing access to a compromising information Motivation of an attacker • Fun! • Blackmail Rather hard to evaluate and control • Self-promotion • Political statement • Revenge • Market competition • Diverting attention More or less predictable! (e.g. in case of theft) • Preventing access to a compromising information Network resource exhaustion • A computer network, as of today*, consists of layers • A network resource is not available to its users when at least one network layer fails to provide service • Hence, a DDoS attack can be attributed to a network layer which it affects DDoS Classification According to the ISO/OSI model: L2-3: generic bandwidth exhaustion L4-6: exploitation of TCP/TLS edge cases L7: application-specific bottlenecks Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification… Typical amplification attack • Most servers on the Internet send more data to a client than Attacker Victim they receive • UDP-based servers generally do not Src: victim (spoofed) verify the source Dst: amplifier Src: amplifier Dst: victim IP address “ANY? com.” • This allows for ”com. NS i.gtld-...” amplification DDoS 1 Gbps 29 Gbps Vulnerable protocols • NTP • RIPv1 • A long list actually • DNS • PORTMAP • Mostly obsolete protocols • SNMP • CHARGEN (RIPv1 anyone?) • SSDP • QOTD • Modern protocols as well: gaming • ICMP • Quake • NetBIOS • … Vulnerable servers • As it’s mostly obsolete servers, they eventually get updated • or replaced • or just trashed • Thus, the amount of amplifiers shows steady downtrend Source: Qrator.Radar network scanner Amp power • Downtrend in terms of the amount – and a downtrend in terms of available power • However, once in a while, a new vulnerable protocol is discovered Source: Qrator.Radar network scanner Mitigation • Most amplification attacks are easy to • NTP • RIPv1 track, as the source UDP port is fixed • DNS • PORTMAP • SNMP • CHARGEN • SSDP • QOTD • ICMP • Quake • NetBIOS • … BGP Flow Spec solves problems? Mitigation • Most amplification • NTP • attacks are easy to RIPv1 track, as the source • DNS • PORTMAP UDP port is fixed • Two major issues: • SNMP • CHARGEN • ICMP • SSDP • QOTD • Amplification without • ICMP • Quake a fixed port (Bittorrent?) • NetBIOS • … memcached • A fast in-memory cache • Heavily used in Web development memcached • A fast in-memory cache • Heavily used in Web development • Listens on all interfaces, port 11211, by default memcached • Basic ASCII protocol doesn’t do authentication • 2014, Blackhat USA: “An attacker can inject arbitrary data into memory” memcached • Basic ASCII protocol doesn’t do authentication • 2014, Blackhat USA: “An attacker can inject arbitrary data into memory” • 2017, Power of Community: “An attacker can send data from memory to a third party via spoofing victim’s IP address” import memcache m = memcache.Client([ ‘reflector.example.com:11211’ ]) m.set(’a’, value) – to inject a value of an arbitrary size under key “a” print ’\0\x01\0\0\0\x01\0\0gets a\r\n’ – to retrieve a value print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’ – to retrieve a value 5 times print ’\0\x01\0\0\0\x01\0\0gets a a a a a\r\n’ – to retrieve a value 5 times. Or 10 times. Or a hundred. Default memcached conf. in Red Hat • memcached listens on all network interfaces • both TCP and UDP transports are enabled • no authentication is required to access Memcached • the service has to be manually enabled or started • the default firewall configuration does not allow remote access to Memcached • Also Zimbra, etc. Amplification factor • Typical amplification factor used to be hundreds • For memcached, it’s millions, and no fixed source port • Amplification isn’t something to underestimate 600 NTP CharGEN 400 QotD RIPv1 200 Quake LDAP 0 Source: https://www.us-cert.gov/ncas/alerts/TA14-017A ipv4 access-list exploitable-ports permit udp any eq 11211 any ! ipv6 access-list exploitable-ports-v6 permit udp any eq 11211 any ! class-map match-any exploitable-ports match access-group ipv4 exploitable-ports end-class-map ! policy-map ntt-external-in class exploitable-ports police rate percent 1 conform-action transmit exceed-action drop ! set precedence 0 set mpls experimental topmost 0 ! Source: http://mailman.nlnog.net/pipermail/nlnog/2018-March/002697.html ... class class-default set mpls experimental imposition 0 set precedence 0 ! end-policy-map ! interface Bundle-Ether19 description Customer: the best customer service-policy input ntt-external-in ipv4 address xxx/x ipv6 address yyy/y ... ! interface Bundle-Ether20 service-policy input ntt-external-in ... ... etc ... Source: http://mailman.nlnog.net/pipermail/nlnog/2018-March/002697.html Proof of Source Address Ownership E.g., QUIC: • Initial handshake packet padded to 1280 bytes • Source address validation Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification… IoT attacks! • 2014: LizardStresser • 2015: SOHO routers become a persistent target for malware • 2016: Mirai • 2017: Persirai, Hajime, … Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks L2-3 mitigation From a victim’s perspective: • Anycast network with enough inspection power • Inventory management to drop unsolicited traffic vectors (e.g. UDP towards an HTTP server) • Rate-limiting less important traffic • Challenges and handshakes (more on that later) L2-3 mitigation From a victim’s perspective: • Anycast network with enough inspection power • Inventory management to drop unsolicited traffic vectors (e.g. UDP towards an HTTP server) • Rate-limiting less important traffic • Challenges and handshakes (more on that later) From an ISP’s view: • Simple heuristics against typical attacks • RTBH (and let the customer take care of it themselves) Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks • L4-6 • SYN flood, TCP connection flood, Sockstress, and so on • TLS attacks Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks • L4-6 • SYN flood, TCP connection flood, Sockstress, and so on An attack can affect • TLS attacks multiple layers at once 21:30:01.226868 IP 94.251.116.51 > 178.248.233.141: GREv0, length 544: IP 184.224.242.144.65323 > 167.42.221.164.80: UDP, length 512 21:30:01.226873 IP 46.227.212.111 > 178.248.233.141: GREv0, length 544: IP 90.185.119.106.50021 > 179.57.238.88.80: UDP, length 512 21:30:01.226881 IP 46.39.29.150 > 178.248.233.141: GREv0, length 544: IP 31.173.79.118.42580 > 115.108.7.79.80: UDP, length 512 L4+ mitigation • SYN flood: 3-way handshake-based SYN cookies & SYN proxy, allowing a victim to verify the source IP address • Other packet-based flood: other handshakes and challenges to do the same • The rest: session analysis, heuristics and blacklists • It is dangerous to use blacklists or whitelists without source IP address verification! IPv6 issues • 128-bit IP addresses • Possible: to address each atom on the Earth surface • Impossible: to store a large number of entries in memory • About 10 years ago, blacklisting whole IPv4 networks was already considered a bad practice • With IPv6, this method has no other way than to return Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks • L4-6 • SYN flood, TCP connection flood, Sockstress, and so on • TLS attacks Attack examples • L2-3 • Volumetric attacks: UDP flood, SYN flood, amplification, and so on (we don’t need to care exactly) • Infrastructure attacks • L4-6 • SYN flood, TCP connection flood, Sockstress, and so on • TLS attacks • L7 • Application-specific flood Wordpress Pingback GET /whatever User-Agent: WordPress/3.9.2; http://example.com/; verifying pingback from 192.0.2.150 • 150 000 – 170 000 vulnerable servers at once • SSL/TLS-enabled Data from Qrator monitoring engine Another example of a L7 attack: FBS • A bot can actually be more clever than a Wordpress machine • Advanced botnets are capable of using a headless browser (IE/Edge or Chrome) => “full browser stack” (FBS) botnets • A FBS-enabled bot is able to go through even complex challenges, like Javascript code execution Another example of a L7 attack: FBS CAPTCHA is a weapon of last resort against FBS.
Load more

Recommended publications
  • IT Acronyms.Docx
    List of computing and IT abbreviations /.—Slashdot 1GL—First-Generation Programming Language 1NF—First Normal Form 10B2—10BASE-2 10B5—10BASE-5 10B-F—10BASE-F 10B-FB—10BASE-FB 10B-FL—10BASE-FL 10B-FP—10BASE-FP 10B-T—10BASE-T 100B-FX—100BASE-FX 100B-T—100BASE-T 100B-TX—100BASE-TX 100BVG—100BASE-VG 286—Intel 80286 processor 2B1Q—2 Binary 1 Quaternary 2GL—Second-Generation Programming Language 2NF—Second Normal Form 3GL—Third-Generation Programming Language 3NF—Third Normal Form 386—Intel 80386 processor 1 486—Intel 80486 processor 4B5BLF—4 Byte 5 Byte Local Fiber 4GL—Fourth-Generation Programming Language 4NF—Fourth Normal Form 5GL—Fifth-Generation Programming Language 5NF—Fifth Normal Form 6NF—Sixth Normal Form 8B10BLF—8 Byte 10 Byte Local Fiber A AAT—Average Access Time AA—Anti-Aliasing AAA—Authentication Authorization, Accounting AABB—Axis Aligned Bounding Box AAC—Advanced Audio Coding AAL—ATM Adaptation Layer AALC—ATM Adaptation Layer Connection AARP—AppleTalk Address Resolution Protocol ABCL—Actor-Based Concurrent Language ABI—Application Binary Interface ABM—Asynchronous Balanced Mode ABR—Area Border Router ABR—Auto Baud-Rate detection ABR—Available Bitrate 2 ABR—Average Bitrate AC—Acoustic Coupler AC—Alternating Current ACD—Automatic Call Distributor ACE—Advanced Computing Environment ACF NCP—Advanced Communications Function—Network Control Program ACID—Atomicity Consistency Isolation Durability ACK—ACKnowledgement ACK—Amsterdam Compiler Kit ACL—Access Control List ACL—Active Current
    [Show full text]
  • Reference Information
    APPENDIX B Software Field Description Tables The window field description tables for the following are included in this section: • “Flow Record Match and Collect Field Descriptions” • “Configure Filter Window Fields” • “Configure Records Window Fields” • “Configure Collector Window Fields” • “Configure Exporter Window Fields” • “Configure Monitor Window Fields” • “Application ID Collect Field Information” Table B-1 lists the match and collect field descriptions for IPv4, IPv6, and Layer 2 flow records in the user interface, as well as the CLI. Table B-1 Flow Record Match and Collect Field Descriptions Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 CoS X X X Ethertype X X X Input SNMP Interface X X X IP Protocol X X IPv4 Destination Address X IPv4 Source Address X IPv4 TOS X IPv4 TTL X IPv6 Destination Address X IPv6 Hop Limit X IPv6 Source Address X IPv6 Traffic Class X Layer 4 Destination Port X X Layer 4 Source Port X X MAC Destination Address X X X Cisco NetFlow Generation Appliance User Guide B-1 Appendix B Software Field Description Tables Table B-1 Flow Record Match and Collect Field Descriptions (continued) Match Fields (keys of the flow GUI and CLI record) IPv4 IPv6 Layer 2 MAC Source Address X X X MPLS Label X X X Output SNMP Interface X X X VLAN ID X X X Collect Fields Application ID1 XXX Byte Count X X X First Timestamp X X X Flow Label X IPv4 ICMP Code X IPv4 ICMP Type X IPv6 ICMP Code X IPv6 ICMP Type X Last Timestamp X X X Network Encapsulation X X X Packet Count X X X TCP Header Flags X X X 1.
    [Show full text]
  • Troubleshooting TCP/IP
    4620-1 ch05.f.qc 10/28/99 12:00 PM Page 157 Chapter 5 Troubleshooting TCP/IP In This Chapter ᮣ Troubleshooting TCP/IP in Windows 2000 Server ᮣ TCP/IP troubleshooting steps ᮣ Defining which is the best TCP/IP troubleshooting tool to solve your problem ᮣ Mastering basic TCP/IP utilities roubleshooting is, it seems, an exercise in matrix mathematics. That is, Twe use a variety of approaches and influences to successfully solve our problems, almost in a mental columns-and-rows format. These approaches may include structured methodologies, inductive and deductive reasoning, common sense, experience, and luck. And this is what troubleshooting is made of. Troubleshooting TCP/IP problems is really no different from troubleshooting other Windows 2000 Server problems mentioned in this book, such as instal- lation failures described in Chapter 2. Needless to say, Windows 2000 Server offers several TCP/IP-related tools and utilities to assist us, but more on the specifics in a moment. TCP/IP Troubleshooting Basics The goal in TCP/IP troubleshooting is very simple: fix the problem. Too often, it is easy to become overly concerned about why something happened instead of just fixing the problem. And by fixing the problem, I mean cost effectively. 1. Be cost effective. Don’t forget that several hours’ worth of MCSE-level consulting could more than pay for the additional bandwidth that may easily solve your TCP/IP WAN-related problem. Don’t overlook such an easy fix when struggling to make a WAN connection between sites utilizing Windows 2000 Server. Too little bandwidth is typically the result of being penny wise and pound foolish.
    [Show full text]
  • 09-Mobile Networking
    Mobile Networking Programming for Engineers Winter 2015 Andreas Zeller, Saarland University Today’s Topics • Mobile Networking • HTTP • HTML • Webserver! The aim of a computer network is Murray Leinster to have computers communicate “A Logic Named Joe” (1946) with each other The computer ... manages the spreading of ninety-four percent of all TV programs, conveys all information about weather, air trafc, special deals… and records every business conversation, every contract… Computers have changed the world. Computers are the civilisation. If we turn them of, we will fall back to a kind of civilisation, of which we have forgotten how it even works. Murray Leinster, 1896–1975 Partial map of the Internet based on the January 15, 2005 data The Internet found on opte.org. Each line is drawn between two nodes, representing two IP addresses. The length of the lines are indicative of the delay between those two nodes. This graph represents less than 30% of the Class C networks reachable by the data collection program in early 2005. Wireless Internet • WLAN = Wireless Local Area Network • Allows “local” computers to communicate The Arduino ESP8266 shield allows the Arduino to connect to Wireless Modem networks, and also to set up its own network The modem is controlled by so- Controlling a Modem called AT commands Modems receive • data to be sent • commands to control them View from above – connectors are Programming for Engineers WS15/16 Prof. Dr. Andreas Zeller saarland Software Engineering Chair Resp. Tutor: Curd Becker university at the bottom ConnectingSaarland University theAssignment Modem Sheet 6 computer science The connectors for the ESP8266 wireless module are shown in more detail here.
    [Show full text]
  • Dos Amplification Attacks – Protocol-Agnostic Detection Of
    DoS Amplification Attacks – Protocol-Agnostic Detection of Service Abuse in Amplifier Networks B Timm B¨ottger1( ), Lothar Braun1 , Oliver Gasser1, Felix von Eye2, Helmut Reiser2, and Georg Carle1 1 Technische Universit¨at M¨unchen, Munich, Germany {boettget,braun,gasser,carle}@net.in.tum.de 2 Leibniz Supercomputing Centre, Munich, Germany {voneye,reiser}@lrz.de Abstract. For many years Distributed Denial-of-Service attacks have been known to be a threat to Internet services. Recently a configura- tionflawinNTPdaemonsledtoattackswithtrafficratesofseveral hundred Gbit/s. For those attacks a third party, the amplifier, is used to significantly increase the volume of traffic reflected to the victim. Recent research revealed more UDP-based protocols that are vulnerable to amplification attacks. Detecting such attacks from an abused ampli- fier network’s point of view has only rarely been investigated. In this work we identify novel properties which characterize ampli- fication attacks and allow to identify the illegitimate use of arbitrary services. Their suitability for amplification attack detection is evaluated in large high-speed research networks. We prove that our approach is fully capa- ble of detecting attacks that were already seen in the wild as well as capable of detecting attacks we conducted ourselves exploiting newly discovered vulnerabilities. 1 Introduction Denial-of-Service attacks aim at making services unavailable to their intended users. Attackers can use different methods to consume bandwidth or deplete other resources of the victim. One method to exhaust bandwidth is called Dis- tributed Reflection Denial-of-Service (DRDoS) attack: an attacker sends forged requests to several servers with the victim’s spoofed source address.
    [Show full text]
  • Vulnerability Report TLP: White
    Vulnerability Report TLP: White Contents 1 Introduction ..................................... 4 2 Overview of Scanning Projects ............... 5 2.1 SSL POODLE Scan ................................................ 6 2.2 HTTP Scan ........................................................ 7 2.3 FTP Scan .......................................................... 8 2.4 RDP ................................................................ 9 2.5 mDNS ............................................................ 10 2.6 SNMP ............................................................. 11 2.7 AFP ............................................................... 12 2.8 NTP .............................................................. 13 2.9 Telnet ........................................................... 14 2.10 SSL Freak ....................................................... 15 2.11 Port Mapper .................................................... 16 2.12 VNC .............................................................. 17 2.13 DNS............................................................... 18 2.14 Netbios .......................................................... 19 2.15 SSDP ............................................................. 20 2.16 ISAKMP .......................................................... 21 2.17 TFTP ............................................................. 22 2.18 RSYNC ........................................................... 23 2.19 SMB .............................................................. 24 2.20 CWMP
    [Show full text]
  • Amplification Hell: Revisiting Network Protocols for Ddos Abuse
    Amplification Hell: Revisiting Network Protocols for DDoS Abuse Christian Rossow VU University Amsterdam, The Netherlands Horst Gortz¨ Institute for IT-Security, Ruhr University Bochum, Germany firstname.lastname @rub.de { } Abstract—In distributed reflective denial-of-service (DRDoS) In distributed reflective denial-of-service (DRDoS) attacks, attacks, adversaries send requests to public servers (e.g., open an adversary aims to exhaust the victim’s bandwidth. He recursive DNS resolvers) and spoof the IP address of a victim. abuses the fact that public servers of UDP-based network These servers, in turn, flood the victim with valid responses protocols respond to requests without further validating the and – unknowingly – exhaust its bandwidth. Recently, attackers identity (i.e., the IP address) of the sender. DRDoS offers many launched DRDoS attacks with hundreds of Gb/s bandwidth of this desired attack features for an adversary: (i) He disguises his kind. While the attack technique is well-known for a few protocols such as DNS, it is unclear if further protocols are vulnerable to identity, as victims receive backscatter traffic from amplifiers, similar or worse attacks. i.e., systems that can be abused to send traffic to the victim on the attacker’s behalf; (ii) The simultaneous abuse of multiple In this paper, we revisit popular UDP-based protocols of amplifiers permits a highly-distributed DoS attack to be con- network services, online games, P2P filesharing networks and ducted from a single Internet uplink. (iii) The traffic reflected P2P botnets to assess their security against DRDoS abuse. We find that 14 protocols are susceptible to bandwidth amplification to the victim is significantly larger in bandwidth than the traffic and multiply the traffic up to a factor 4670.
    [Show full text]
  • Threat Landscape and Good Practice Guide for Internet Infrastructure
    Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 European Union Agency for Network and Information Security www.enisa.europa.eu Threat Landscape and Good Practice Guide for Internet Infrastructure January 2015 About ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Authors Dr. Cédric Lévy-Bencheton (ENISA), Dr. Louis Marinos (ENISA), Rossella Mattioli (ENISA), Dr. Thomas King (DE-CIX Management GmbH), Christoph Dietzel (DE-CIX Management GmbH), Jan Stumpf (DE-CIX Management GmbH) Contact For contacting the authors please use [email protected] For media enquires about this paper, please use [email protected] Acknowledgements For the completion of this study, ENISA has worked closely with: • The “Internet infrastructure security and resilience” reference group. • Individual experts that reviewed the results and provided valuable feedback: Randy Bush (Internet Initiative Japan), Patrick Fältström (Netnod), Peter Koch (DENIC), Benno Overeinder (NLnetLabs), Andrei Robachevsky (Internet Society). We are grateful for their valuable input and comments.
    [Show full text]
  • Port Ranges Traffic Analysis
    Simon Owens Port Ranges • Ports 0 to 1023 are Well-Known Ports. • Ports 1024 to 49151 are Registered Ports (often registered by a software developer to designate a particular port for their application) • Ports 49152 to 65535 are Public Ports. Traffic Analysis - Wireshark Configure Name Resolution 1. Make a new profile 2. Make a “hosts” file with format “ip hostname” 3. Place that “hosts” file in the ~/.config/wireshark/configprofilename/ folder 4. open pcap file, select your configuration profile, and ensure “view>>name resolution>>resolve network/transport address names” is checked Configure Ports 1. Go to “Edit>>preferences>>columns” and add src and dst ports to the display Figuring out what multi-cast goes too 1. Fill out “hosts” and “services” file if you can 2. Click on various multi-cast products – generally the parameters will identify what the application is with a version or the company that made it. Query for Common Ports • tcp.dstport >= 0 and tcp.dstport <= 10000 || tftp || dns Saving off filters to make capture smaller 1. Apply a filter 2. Click “File>> Export Specified Packets” then save them to a file Search for Strings • Edit >> find packet Extracting files • file >> export objects Find Hashes • net-creds.py file.pcap Changing Parameters in the Packets Simon Owens • Port Scan Netdiscover -r <ip-range> make sure you know everything on network IP=insert mkdir $IP Masscan: • masscan -p0-65535 $IP --banners -oG $IP/masscan_$IP.grep Nmap: • Nmap -sV -T4 $IP -oN $IP/normalNmap.txt • nmap -v -sS -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/TCPscan_$IP • nmap -v -sU -T4 -A --script=vuln --host-timeout 336h -p 0-65535 $IP -oA $IP/UDPscan_$IP General Services: • 9/tcp - Discard o Discard Protocol - https://www.exploit-db.com/exploits/19555 The Discard Protocol is a service in the Internet Protocol Suite defined in RFC 863.
    [Show full text]
  • Draft SP 800-189, Secure Interdomain Traffic Exchange
    Withdrawn Draft Warning Notice The attached draft document has been withdrawn, and is provided solely for historical purposes. It has been superseded by the document identified below. Withdrawal Date October 17, 2019 Original Release Date December 17, 2018 Superseding Document Status 2nd Public Draft (2PD) Series/Number NIST Special Publication 800-189 Title Resilient Interdomain Traffic Exchange: BGP Security and DDoS Mitigation Publication Date October 2019 DOI https://doi.org/10.6028/NIST.SP.800-189-draft2 CSRC URL https://csrc.nist.gov/publications/detail/sp/800-189/draft Additional Information 1 Draft NIST Special Publication 800-189 2 3 Secure Interdomain Traffic Exchange 4 BGP Robustness and DDoS Mitigation 5 6 Kotikalapudi Sriram 7 Doug Montgomery 8 9 10 11 12 13 This publication is available free of charge from: 14 https://doi.org/10.6028/NIST.SP.800-189-draft 15 16 17 C O M P U T E R S E C U R I T Y 18 19 20 Draft NIST Special Publication 800-189 21 22 Secure Interdomain Traffic Exchange 23 BGP Robustness and DDoS Mitigation 24 25 Kotikalapudi Sriram 26 Doug Montgomery 27 Advanced Network Technology Division 28 Information Technology Laboratory 29 30 31 32 33 34 35 36 This publication is available free of charge from: 37 https://doi.org/10.6028/NIST.SP.800-189-draft 38 39 40 December 2018 41 42 43 44 45 U.S. Department of Commerce 46 Wilbur L. Ross, Jr., Secretary 47 48 National Institute of Standards and Technology 49 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 50 Authority 51 This publication has been developed by NIST in accordance with its statutory responsibilities under the 52 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C.
    [Show full text]
  • ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction
    ELFIQ APP OPTIMIZER White Paper V1.03 - May 2015 CONTENTS Introduction ...............................................................................................................................................................................3 Signature-Based Recognition vs. ACL’s ................................................................................................................3 Detection Engine ...................................................................................................................................................................3 Using Groups or Individual Applications .............................................................................................................3 Actions Once an Application is Detected ...........................................................................................................3 Appendix A: Application List ........................................................................................................................................ 4 martellotech.com elfiq.com 2 INTRODUCTION The Elfiq AppOptimizer is designed to give organizations full control over their existing and future bandwidth, guaranteeing key applications such as Citrix XenDesktop or Skype get priority treatment and undesirables such as peer-to-peer file transfers or games are limited or no longer permitted. It is an add-on-module that provides application-layer deep packet inspection (layer 7) classification and control, including Mobile, Social Networking, P2P, Instant Messaging,
    [Show full text]
  • Download Pdf Presentation Here
    Brocade SDN/OpenFlow Update Legal Disclaimer All or some of the products detailed in this presentation may still be under development and certain specifications, including but not limited to, release dates, prices, and product features, may change. The products may not function as intended and a production version of the products may never be released. Even if a production version is released, it may be materially different from the pre-release version discussed in this presentation. NOTHING IN THIS PRESENTATION SHALL BE DEEMED TO CREATE A WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT OF THIRD-PARTY RIGHTS WITH RESPECT TO ANY PRODUCTS AND SERVICES REFERENCED HEREIN. ADX, AnyIO, Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, HyperEdge, ICX, MLX, MyBrocade, OpenScript, VCS, VDX, and Vyatta are registered trademarks, and The Effortless Network and The On-Demand Data Center are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of others. © 2015 Brocade Communications Systems, Inc. All Rights Reserved. 2 Agenda • Brocade Flow Optimizer Application • Brocade SDN Controller • New Brocade OpenFlow router features • Presenter’s latest research work © 2015 Brocade Communications Systems, Inc. All Rights Reserved. 3 Brocade Flow Optimizer Application REST API Internet
    [Show full text]